Information disclosure in Google Chrome - CVE-2017-5082

Vulnerability identifier: #VU6968

CSH Severity: Low

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-5082

CWE-ID: CWE-200

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to obtain potentially sensitive information.

The weakness exists due to insufficient hardening flaw in the credit card editor component of the Chromium browser. A remote attacker can gain access to credentials.

Google Chrome
Arch Linux
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Fedora
Opensuse
chromium-native_client
chromium

Update to version 59.0.3071.86.

Google Chrome - update to 59.0.3071.86
chromium-native_client - addressed in versions 59.0.3071.86-1.20170607gitaac1de2.fc24, 59.0.3071.86-1.20170607gitaac1de2.fc25, 59.0.3071.86-1.20170607gitaac1de2.fc26
chromium - addressed in versions 59.0.3071.86-3.el7, 59.0.3071.104-1.el7

• https://chromereleases.googleblog.com/2017/06/stable-channel-update-for-desktop.html?utm_source=feed...
• https://security.archlinux.org/advisory/ASA-201706-8

• Multiple vulnerabilities in Google Chrome
• openSUSE update for chromium
• Arch Linux update for chromium
• OpenSUSE Linux update for chromium
• Red Hat update for chromium-browser
• Fedora EPEL 7 update for chromium
• Fedora 24 update for chromium-native_client
• Fedora 25 update for chromium-native_client
• Fedora 26 update for chromium-native_client
• Fedora EPEL 7 update for chromium